@indigoai-us/hq-cli 5.201.0 → 5.201.1

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.201.1] — 2026-09-25
+
+### Fixed
+
+- Outpost grant checks now include child lanes from the owning Outpost. Owner
+  records take precedence over duplicate primary records, and each grant
+  command reads the owner lane list once.
+- Outpost grant checks re-read owner lanes under the hire lock and use the
+  validated Outpost CLI override for the lane-list probe.
+
 ## [5.201.0] — 2026-09-25
 
 ### Added

package/dist/commands/lanes.js

@@ -479,6 +479,14 @@ function laneHireFields(lane, lanes) {
         hire_summary: hireSummary,
     };
 }
+function mergeOwnerLaneHierarchy(supplied, ownerLanes) {
+    const byId = new Map();
+    for (const lane of supplied)
+        byId.set(lane.lane_id, lane);
+    for (const lane of ownerLanes)
+        byId.set(lane.lane_id, lane);
+    return [...byId.values()];
+}
 function outpostCliOverride(ctx, outpostId) {
     const envKey = `HQ_LANES_OUTPOST_CLI_${outpostId.toUpperCase().replace(/[^A-Z0-9_]/g, "_")}`;
     const configured = ctx.env[envKey];
@@ -1031,11 +1039,12 @@ async function loadHostCapacitySnapshots(ctx, hqRoot, config = loadLanesConfig(h
     };
 }
 async function readOutpostLaneRecords(ctx, outpostId) {
+    const hqBinary = outpostCliOverride(ctx, outpostId);
     let result;
     try {
         result = await ctx.dispatchOutpostExec({
             outpostId,
-            command: buildOutpostLaneListCommand(),
+            command: buildOutpostLaneListCommand({ hqBinary }),
             timeoutSeconds: CAPACITY_PROBE_TIMEOUT_MS / 1000,
             waitMs: CAPACITY_PROBE_TIMEOUT_MS,
         });
@@ -3312,9 +3321,20 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
         throw new LanesError("outpost_dispatch_failed", `Lane ${lane.lane_id} has no Outpost host to dispatch to`, { lane_id: lane.lane_id });
     }
     const outpostId = lane.host.id;
-    const grantContext = action === "grant"
-        ? createOutpostHireGrantContext(lane, loadAllLanes(ctx.hqRoot()), await ctx.laneHireGrantsEnabled(lane.company))
-        : undefined;
+    let grantContext;
+    let grantHierarchy;
+    if (action === "grant") {
+        const enforcementEnabled = await ctx.laneHireGrantsEnabled(lane.company);
+        let hierarchy = loadAllLanes(ctx.hqRoot());
+        const ownerLanes = await readOutpostLaneRecords(ctx, outpostId);
+        const byId = new Map(hierarchy.map((record) => [record.lane_id, record]));
+        for (const ownerLane of ownerLanes) {
+            byId.set(ownerLane.lane_id, ownerLane);
+        }
+        hierarchy = [...byId.values()];
+        grantHierarchy = hierarchy;
+        grantContext = createOutpostHireGrantContext(lane, hierarchy, enforcementEnabled);
+    }
     let dispatched;
     try {
         dispatched = await ctx.dispatchOutpostExec({
@@ -3407,6 +3427,7 @@ async function dispatchOutpostLaneCommand(ctx, lane, action, options) {
             ...remote,
             lane_id: ownerLane.lane_id,
             lane: ownerLane,
+            ...laneHireFields(ownerLane, grantHierarchy ?? []),
             outpost_id: outpostId,
             outpost_command_id: dispatched.commandId,
             outpost_transport: "outposts_exec",
@@ -4518,7 +4539,11 @@ async function applyHireGrant(ctx, laneId, hireGrant, authorization, grantContex
             (!grantContext || !sameHireGrantSenior(current.senior, grantContext.expected_senior))) {
             throw new LanesError("hire_grant_senior_changed", `Lane ${laneId}'s senior changed before the Outpost applied the grant update`, { lane_id: laneId, current_senior: current.senior });
         }
-        const hierarchy = grantContext?.hierarchy ?? loadAllLanes(hqRoot);
+        const hierarchy = grantContext
+            ? authorization === "ssm-owner-dispatch"
+                ? mergeOwnerLaneHierarchy(grantContext.hierarchy, loadAllLanes(hqRoot))
+                : grantContext.hierarchy
+            : loadAllLanes(hqRoot);
         if (enforce && current.senior.kind === "lane") {
             if (!current.senior.id) {
                 throw new LanesError("hire_grant_senior_invalid", `Lane ${laneId} has a lane senior without an id`, {
@@ -4604,7 +4629,8 @@ async function runGrantOwnerTarget(ctx, laneId, opts) {
     const hireGrant = parseHireGrant(opts.hire);
     const grantContext = parseOutpostHireGrantContext(opts.grantContext, laneId);
     const hqRoot = ctx.hqRoot();
-    printGrantResult(hqRoot, await applyHireGrant(ctx, laneId, hireGrant, "ssm-owner-dispatch", grantContext), grantContext.hierarchy);
+    const updated = await applyHireGrant(ctx, laneId, hireGrant, "ssm-owner-dispatch", grantContext);
+    printGrantResult(hqRoot, updated, mergeOwnerLaneHierarchy(grantContext.hierarchy, loadAllLanes(hqRoot)));
 }
 async function runBackfillGrants(ctx, opts) {
     if (opts.apply && opts.dryRun) {

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -72,7 +72,7 @@ export declare function parseOutpostPickupPayload(raw: unknown): OutpostPickupPa
 export declare function buildOutpostPickupCommand(payloadUrl: string): string;
 /** Bounded, read-only capacity query executed by the target Outpost CLI. */
 export declare function buildOutpostCapacityCommand(): string;
-/** Read every lane on an Outpost, optionally using its configured HQ binary. */
+/** Read lane records owned by an Outpost, using its configured HQ binary when set. */
 export declare function buildOutpostLaneListCommand(input?: {
     hqBinary?: string;
 }): string;

package/dist/lib/lanes/outpost-dispatch.js

@@ -65,7 +65,7 @@ export function buildOutpostPickupCommand(payloadUrl) {
 export function buildOutpostCapacityCommand() {
     return withRemoteHqDir(joinCommandParts(["hq", "lanes", "capacity", "--json"]));
 }
-/** Read every lane on an Outpost, optionally using its configured HQ binary. */
+/** Read lane records owned by an Outpost, using its configured HQ binary when set. */
 export function buildOutpostLaneListCommand(input = {}) {
     return withRemoteHqDir(joinCommandParts([
         input.hqBinary?.trim() || "hq",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.201.0",
+  "version": "5.201.1",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {